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Mission 

Our mission is to provide independent, relevant, and timely oversight 
of the Department of Defense that supports the warfighter: promotes 
accountability, integrity, and efficiency; advises the Secretary of 
Defense and Congress: and informs the public. 


Vision 

Our vision is to be a model oversight organization in the Federal 
Government by leading change, speaking truth, and promoting 
excellence—a diverse organization, working together as one 
professional team, recognized as leaders in our field. 
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(U) Objective 


(U) Finding (cant'd) 


(U) We determined whether Combatant 
Commands had sufficient cyber personnel 
and support from U.S. Cyber Command 
[USCYBERCOM] to effectively conduct 
cyber operations in their areas 
of operations. 

(U) Finding 



prioritized implementing and fielding the 
Cyber Mission Forc es; and USCYBERCO M's temporary solution to task 

while fielding Cyber Mission 


Service Component! 


(.’llensive, defVi)si\’i', and Dnl) intoniuuioii Nntwnrk i yin'i'.space 


execute missions. 


[U//P9##] Combatant commanders made 
progress in implementing a command and 
control structure for cyberspace 
operations; however, additional actions are 
needed. Additionally, U.S. Pacific Command 
(USPACOM] an d U.S. Central Comman d 

fUSCENTC OM)ij|iiliiililHlll(llli 

in their joint Cyber Centers and 
Cyber Support El ement [CSEl support from 
USCYBERCOM 

directed by the Staff 
for planning, integrating and synchronizing 
cyberspace operations. Specifically: 


• USPAC OM joint Cyber Cent er 

■oTrLl SSMiii 

of the tasks; 

• USCENTCO M)oint_ 

Cybe^ent^personnel^^H 

I^HHHgofthetaslcsaiid 

of the 

tasks; and 

• USCYBERCOM did not 


at USPACOM and at 
USCENTCOM. 


This occurred 

because previously validated and approved 


based on new cyber requirements; DoD 


(U) Recommendations 

(U) We recommend that the Director, joint Staff develop a 
communications strategy for disseminating incremental decisions 
and needed guidance. We also recommend that all combatant 
commanders conduct a command-wide, mission-impact analysis of 
cyberspace mission requirements, needed resources, and capability gaps 
affecting their ability to effectively implement command and control of 
cyberspace operations. Furthermore, we recommend that the 
Commanders, U.S. Strategic Comman d and USCYBERCOM increase 
CSE staffing at Combatant Co in in ||||]-i|||i|j|n|iii|||a|j|ji^^^mj^J 

(U) Management Comments and 
Our Response 

(U) We did not receive comments from the Commanders, USPACOM; 

U.S. European Command; U.S. Southern Command; U.S. Special Operations 
Command; U.S. Transportation Command; U.S. Strategic Command; 

U.S. Northern Command; and U.S. Africa Command, in response to the 
draft report We revised recommendations based on management 
comments. Comments from USCYBERCOM and USCENTCOM partially 
addressed the recommendations, but further comments are required. 
Additionally, comments from the joint Staff did not address the specifics 
of the recommendations. We request management comment on the final 
report by january 8,2015. Please see the Recommendations Table on the 
back of this page. 
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(U) Recommendations Table 


Unclassified 

Recommendations 

No A(iditional'lcbmments 

Management 

Requiring Comments 

■■'Reflp.tred;;. , 

Commander, U.S. Pacific Command 

Commander, U.S. European Command 
Commander, U.S. Southern Command 
Commander, U.S. Central Command 

Commander, U.S. Special Operations Command 
Commander, U.S. Transportation Command 
Commander, U.S. Strategic Command 
Commander, U.S. Northern Command 
Commander, U.S. Africa Command 

2 


Commander, U.S. Strategic Command 
Commander, U.5. Cyber Command 

3 



Director, Joint Staff 1 

Unclassified 


(U) Please provide Management Comments by January 8,2015. 
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tNSPEaOR GENERAL 
DEPARTMENTOF DEFENSE 
4800 MARK CENTER DRIVE 
ALEXANDRIA, VIRGINIA 223SO-1SOO 

December 8, 2014 


(U] MEMORANDUM FOR DISTRIBUTION 


(U) SUBJECT: Joint Cyber Centers _ 

Cyberspace 

{U//f«t»J (Report No. DODIG-201S-048) 

We are providing this report for review and comment. Combatant 
commanders made progress in implementing a command and control structure for cyberspace 
operations; however, further actions and resources are needed to 
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do not exist within the other warPighting domains. In particular, U.S. Pacific Command and 
U.S. Central Command, which are recognized within DoD as having more mature cyberspace 
capabilities,support from 
U.S. Cyber Command toMMHHMHIM^^^^Fcyberspace operations. 


(U] We considered management comments on a draft of this report when preparing the final 
report. However, the Commanders. U.S. Pacific Command; U.S. European Command; U.S. Southern 
Command: U.S. Special Operations Command; U.S. Transportation Command; U.S. Strategic 
Command; U.S. Northern Command; and U.S. Africa Command did not comment on 
Recommendation 2, and the Commander, U.S. Strategic Command, did not comment on 
Recommendation 3. DoD Directive 7650.3 requires that recommendations be resolved promptly. 
Therefore, we request that the commanders provide comments on the finding and 
recommendations by January 8,2015. 


(U) As a result of management comments, we revised Recommendations 2 and 3. The Vice Director, 
Joint Staff, responding for the Director, Joint Staff, did not address the specifics of 
Recommendation 1. The Chief, Manpower Division, Jl, responding for the Commander, 

U.S. Central Command, partially addressed the specifics of Recommendation 2. The Deputy 
Commander, USCYBERCOM, responding for the Commander, USCYBERCOM, partially addressed the 
specifics of Recommendation 3. We request that the Director, Joint Staff; the Commander, 

U.S. Central Command: and the Commander, U.S. Cyber Command, provide additional comments on 
the final report by January 8,2015. Although not required to comment, the Director, Cost 
Assessment and Program Evaluation, agreed with the finding. 
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(U] Please provide comments that conform to the requirements of DoD Directive 7650.3. Classified 
comments must be sent electronically over the SECRET Internet Protocol Router Network 
(SIPRNET). Please send a PDF file containing your comments 

Copies of your comments must have the actual signature of the 
authorizing official for your organization. We cannot accept the /Signed/ symbol in place of the 
actual signature. Comments provided on the report must be marked and portion-marked, as 
appropriate, in accordance with DoD Manual 5200.01. If you consider any matters to be exempt 
from public release, you should mark them clearly for inspector General consideration. 

(U) We appreciate the courtesies extended to the staff. Please direct questions to me at 
{703^ 699-7331 (DSN 499-73313. 




A- 

Carol N. Gorman 
Assistant Inspector General 
Readiness and Cyber Operations 
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(1J) Introduction 
(U) Objective 

(U) Our objective v^as to determine whether Combatant Commands had sufficient cyber 
personnel and support from U.S. Cyber Command (USCYBERCOM) to effectively conduct 
cyber operations in their areas of operations. [See Appendix A for the scope and 
methodology and prior audit coverage related to the objective.] 

(U) Background on DoD Cyberspace Operations 

DoD uses cyberspace to enable its military, intelligence, and business 
operations, including the movement of personnel and material and the command and 
control [C2) of the full spectrum of military operations. Cyberspace is one of the five 
DoD domains; the other domains are air, land, maritime, and space. Cyberspace, unlike 
the other physical domains, is a global domain within the information environment 
consisting of interdependent networks of information technology infrastructures and 
resident data, including the Internet, telecommunications networks, computer systems, 
and embedded processors and controllers. Cyberspace operations employ cyberspace 
capabilities to ensure access and freedom of operations in, through, and from 
cyberspace to deliver effects in any of the domains at times and places of DoD’s 
choosing; to deny adversaries access and freedom of operations at times and places of 
DoD's choosing; and to sustain mission-essential segments of cyberspace (networks) in 
the fece of adversary action or stressed environments. 

(U//P@<!>S) Cyberspace operations are categorixed under three lines of operations 
based on their intent 

1. (U//Pew) Offensive Cyberspace Operations. Project power by the 
application offeree in and through cyberspace. 

2. Defensive Cyberspace Operations. Defend DoD or other 
friendly cyberspace. 
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3. [U//fOW] DoD Information Network (DoDIN) Operations. Design, build, 
configure, secure, operate, maintain, and sustain DoD communications systems 
and networks to create and preserve data availability, integrity, confidentiality, 
as well as user authentication and nonrepudiation.* 

(U) Cyberspace Responsibilities and Requirements 

Under the authority of the Secretary of Defense, DoD uses cyberspace 
capabilities to perform integrated offensive and defensive operations. The Deputy 
Assistant Secretary of Defense for Cyber Policy, Office of the Under Secretary of Defense 
for Policy, integrates cyberspace operations into national and DoD strategies, develops 
policy related to cyber forces and employment of those forces, and ensures cyber 
capabilities are integrated into operation and contingency plans. The Chairman of the 
Joint Chiefs of Staff ensures cyberspace plans and operations are compatible with other 
military plans. Although the Commander, U.S. Strategic Command [USSTRATCOM) is 
responsible for securing, operating, and defending the DoDlN, and critical cyberspace 
assets, systems, and functions against an intrusion or attack, the Commander delegated 
most cyberspace responsibilities to the Commander, USCYBERCOM. The Commander, 
USCYBERCOM has three mission areas; defend the Nation against strategic cyber 
attacks; support Combatant Command contingency and operational planning; and 
support the security, operation, and defense of the DoDIN. 

The other combatant commanders operate and defend their tactical and 
constructed networks and integrate cyberspace capabilities into all military 
operations. As such, combatant commanders have responsibility for integrating 
cyberspace capabilities into their command plans and coordinating with other 
combatant commanders, the Military Services, and DoD agencies to create fully 
integrated capabilities. The Military Services support combatant commanders by 
organizing, training, and equipping forces in addition to securing and defending their 
global networks. 

On May 1, 2012, the Secretary of Defense issued a memorandum, 
'Transitional Framework for Cyberspace Operations Command and Control (€2)," 
directing combatant commanders to establish Joint Cyber Centers (JCCs) using existing 
capabilities and personnel to standardize C2 of cyberspace operations based on the 


' Nonrepudiation Is assurance the sender of data receives proof of dellverv end the recipient receives proof of 

the sender's Identify to prevent either from later denying they processed the data. 
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{U//TfJTKf) March 15,2012, Joint Staff Transitional Cyberspace Operations C2 Concept 
of Operations. [See Appendix B for a timeline of critical cyberspace events related to 
combatant commanders establishing JCCs and taking responsibiliQ' for planning and 
integrating cyberspace into operations.] The Transitional Cyberspace Operations C2 
Concept of Operations requires USSTRATCOM and USCYBERCOM to directly support 
JCC operations through forward-deployed Cyber Support Elements (CSEs).^ 
Additionally, it requires JCCs to perform 41 cyberspace tasks related to coordinating, 
planning, synchronizing, and deconflicting Combatant Command cyberspace 
operational requirements. It also requires combatant commanders to perform 
24-unique cyberspace tasks but does not specify that the JCCs are responsible for 
performing these tasks. At U.S. Pacific Command 

whereas the JCC at U.S. Central Command [USCENTCOM} was 

[See Appendix C for the list of 65 cyberspace tasks 
directed by the Joint Staff.] Joint Publication 3-12, "Cyberspace Operations," 

February S, 2013, requires USCYBERCOM CSEs to provide JCCs with reachback^ 
capabilities and support from USCYBERCOM and the Service Components. The Joint 
Staff Transitional Cyberspace Operations C2 Concept of Operations requires CSEs to 
perform six-unique tasks to support JCCs in planning and integrating cyberspace into 
command operations. 


The Chairman of the Joint Chiefs of Staff issued an "Execute 


Order to Implement Cyberspace Operations C2 Framework," June 21,2013, 



’ (U//PnM) CSEs are cyberspace operations planners atKl subject matter experts. 

* (U//a*iM) USCENTCOM's analysis of IIS JCCs ability to complete cyberspace tasks was based only on 
60 of the 6S Joint Staff-directed tasks because other USCENTCOM joirti directorates were responsible 
fortheS tasks. 

‘ (U//IM(M) Reachback Is performed by the CSEs. as USCYBERCOM experts, to facilitate communication with USCYBERCOM 
to enable coordination, deconflictlon, andsynchronlaatlon of supporting USCYBERCOM effects as requested by the 
Combatant Commands. 
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(U) Source; USCYBERCOM 


(UZ/Wt#®*) USCYBERCOM documentation defines thej 

at the operational level of warfare with a matrixed-staff 
organization planning and executing military cyberspace operations. The primary 
difference between the two models is that the operational control model gives 
combatant commanders operational control over specific Combat Mission Forces 
(Combat Mission Teams and Combat Support Teams). The Joint Staff acknowledged 
that all Combatant Commands would not implement the operational control model 
because of differences in each command's cyberspace mission. Figure 2 on the next 
page describes the future C2 operational structure. 
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(U) Source: USCYBERCOM 


^j) The Cyber Mission Forces are composed of 
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In total, DoD plans to dedicate approximately 

. Throughout 

FY 2014, USCYBERCOM and the Service Components fielded 
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Table 1 on the next page identifies the composition and missions of the 

teams and the number of teams and personnel comprising 
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each team. 
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*(U//TO99) The Execute Order directs combatant commanders, upon initial operating capability, to 
assume operational control over Combatant Command Cyber Protection Teams. 

(U) Review of Internal Controls 

(U) DoD Instruction 5010.40, "Managers' Internal Control Program Procedures," 

May 30, 2013, requires DoD organizations to implement a comprehensive system of 
internal controls that provides reasonable assurance that internal controls are 
operating as intended and to evaluate the effectiveness of the controls. We did not find 
internal control weaknesses at USPACOM, USCENTCOM, or USCYBERCOM related to our 
audit objective. Although we did not identify any internal control weaknesses, we found 
deficiencies at USPACOM, USCENTCOM, and USCYBERCOM that affected the commands' 
ability to effectively plan and integrate cyberspace into command plans and operations. 
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(U) Finding 


(U//POtfO) Resources Needed to Effectively 
Plan and Integrate Combatant Command 
Cyberspace Operations 

Combatant commanders made progress in implementing a 
C2 structure for cyberspace operations by establishing |CCs and integrating 
CSEs into daily operations. However, additional actions are needed In a 
resource-constrained environment to enable combatant commanders to 
effectively plan and integrate cyberspace into operations. 
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CU//WW5 In addiUon, USPACOM and USCENTCOM 
I and CSE support from USCYBERCOM^ to 

directed by the loint Sta^' for planning, integrating, and 
synchronizing cyberspace operations. Specincally; 

• ^ USPACOM 



and were 
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of 


the tasks; 


(U// P0 ' U03 USCENTCOM }CC personnel complete 
I of the tasks, and were 
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of the tasks; and 


(UZ/PWe) USCYBERCOM 
CSEs at USPACOM and at USCENTCOM 
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the CSEs to effectively 


tasks and to support JCC cyberspace operations. 


’ {U//MMI Although the Execute Ortlerand Transitional Cyberspace Operations C2 Concept of Operations directed 
USSTRATCOM and USCYBERCOM to provide CSEs, we focused or^ USCYBERCOM because it requested permanent billets 
and Issued task orders to meet this requirement 


t 


{U//YVB9) USCENTCOM officials stated other joint directorates and t>oI the JCC 
We did not assess whether the joint directorates completed these tasks. 
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(U) This occurred because: 

• previously validated and approved 


to support 


the fielding Forces and changes to the 

cyberspace environment; 


(U//P©W5 DoD prioritized the implementation and helding of the 
Forces; and 


^lUSCYBFRCOM’s 
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As a result, USPACOM and USCENTCOM have 
capabilities into 
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operations and command plans, 

to execute the combatant commanders' missions. Specifically, 
USPACOM ICC personnel 


operational and contingency plans, while USCENTCOM 

plans. 

(U) Progress Made in implementing the Transitional 
Cyberspace Operations C2 Concept of Operations 

Combatant commanders made progress in implementing the |oint Staff 
Transitional Cyberspace Operations C2 Concept of Operations 
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(U//PWf0) Since establishing the |CCs, USPACOM and USCENTCOM began planning, 
directing, and synchronizing cyberspace operations with support from 
forward-deployed CSEs. Specifically, they began focusing on cyberspace situational 
awareness and incorporating cyberspace into their operational and contingency plans; 
exercises; and boards, bureaus, centers, cells, and working groups^ For example, the 
Director, 16 [Command, Control, Communications, and Cyber] requires daily reporting 
and weekly cyber update briehngs from all components and forces in the USPACOM 
theater to synchronize cyberspace operations and to provide the Commander, 
USPACOM continuous situational awareness of cyberspace issues and threats affecting 
the command. Further, the USPACOM and USCENTCOM JCCs began developing or 
expanding cyberspace partnerships with allies, international partners, and other 
Governmental agencies in their areas of operation. For example, USCENTCOM issues 
threat warnings to regional partners about their critical infrastructure and key 
resources 


While DoD made progress in implementing command structures 
for executing the new cyber mission, additional actions are needed in a 

resource-constrained environment to enable all 
Combatant Commands to effectively plan and integrate 
cyberspace into operations. USPACOM and 
USCENTCOM oRIcials stated that although they 
generally shared information between the commands 
pertaining to their progress in implementing the direct support model QCC and CSE 
construct), they did not regularly communicate similar Information with other 
Combatant Command ICC personnel. Officials from the Joint Staff acknowledged that 


(y//rCi!y'f AcfcliLiomil 
uctions ore neeileil in ci 
resource-constrained 
enviroinnent. 


In addition. Joint Staff 
officials also acknowledged that Combatant Commands were not effectively 


' (U) Boards, bureaus, centers, cells, and working groups include cross-functional experts (for example, representation from 
multiple joint directorates with a stake In a particular mission or task) within a Combatant Command brought together to 
facilitate, coordinate, plan, and execute specific missions 
and tasks. 
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CU//' P e UO] Additionally, USPACOM and USCENTCOM officials identified the need for 
further guidance and information from the Joint Stafi' to assist them in planning and 
integrating cyberspace into operations based on the rapidly changing cyberspace 
domain. For example, USPACOM officials stated that additional information to better 
understand the genesis of cyberspace decisions afi’ecting Combatant Commands, and 
guidance identilying Combatant Command authorities for planning and executing 
operations and sharing information with partners was needed. Additionally, 
USCENTCOM officials stated that guidance was needed for integrating the JCCs and 
CSEs, and for prioritizing and responding to Combatant Command threats. 
Furthermore, USCENTCOM officials 


incorporate lessons learned from the commands that implemented JCCs to better enable 
the commands to identify needed JCC resources. 


(U//f*W©) Not regularly sharing information or providing timely guidance and 
decisions decreased the combatant commanders' abilify to effectively plan and 
prioritize cyberspace operations in a resource-constrained and rapidly evolving 
domain. The Joint Staff and the Commander, USCYBERCOM could consider conducting 
regular global synchronization conferences as part of their strategy for improving 
communication. Additionally, the Joint Staff, in coordination with USSTRATCOM, could 
consider updating the Transitional Cyberspace Operations C2 Concept of Operations or 
issuing an updated Execute Order or fragmentary order to provide more timely 
guidance. The Director, Joint Staff should develop a communications strategy for 
disseminating incremental decisions and timely guidance affecting cyberspace 
command and control until the end-state for command and control of cyberspace 
operations is defined and achieved. 
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Personnel to Perform Cyberspace Tasks 
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Cyberspace Operations 






























(U//PWW^ In 2012, USPACOM established its JCC usingQ personnel from its J6 to 
accomplish the cyberspace tasks directed by the Joint Staff. In addition, the USPACOM 
J2 (Intelligence) and J3 (Operations) supported the JCC in performing the cyberspace 
tasks. The Director, J6, USPACOM recognized the need for additional staff. As a result, 
the Chief of Staff, USPACOM requested a comprehensive manpower and organizational 
evaluation of the missions, functions, and required capabilities of USPACOM based on 
factors such as the evolving national cyber mission. The results of that evaluation, 
which were completed in April 2013, showed USPACOM 
HH||H| perform the core JCC functions. 
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(U) USPACOM would receive 
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inFY2015;a 


I in FY 2016; ar>daBOBB|Q| in FY 2017. 
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and the theater. 
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Integrating 


(U/ /rOUO) USCENTCOM 
Cyberspace Operations 

USCENTCOM plan, coordinate, 

integrate, and synchronize cyberspace operations. Specifically, the USCENTCOM JCC 
performing cyberspace operations as of May 2014. Although we 
requested, and the JCC Chief agreed to provide, an updated analysis of the JCCs ability to 
complete foint Staff-directed tasks during the audit, USCENTCOM did not conduct that 
assessment. The most recent USCENTCOM assessment, which JCC personnel completed 
in February 2013 
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(U) Recurring 
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Personnel 


(U] During 2012 and 2013, a Joint Staff]? Joint and Coalition Operational Analysis team 
conducted an initial assessment of DoD’s effectiveness in implementing the Secretary of 
Defense-directed transitional C2 framework. The Joint and Coalition Operational 
Analysis report, "Transitional Cyberspace Operations C2 Concept of Operations," 

July 15.2013, 
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The report found that jCCs used 
matrixed-organizational constructs, dual-hatted personnel, or augmentees to fill staffing 
shortages. 


(U//P©W) As previously reported, USPACOM and USCENTCOM 

In addition to their requests, 
U.S. Northern Command and U.S. Southern Command als 

For the FY 2016 Program 
Budget Review process, the Joint Staff provided documentation showing that seven of 
the nine Combatant Commands already submitted memorandums describing their 


^ (U) A targeteersupports Combatant Command cyber targeting processes to ensure targets are Integrated into or 
deconfllcted with plans and operations. 

























Based on information obtained from USPACOM and USCENTCOM, in 
addition to the Joint and Coaiition Operational Analysis findings and the Combatant 



|. Until each Combatant Command identifies all cyberspace 
requirements affecting its command and conducts a thorough analysis of JCC functions, 

these 

challenges will continue to exist. Therefore, all combatant commanders should conduct 
a detailed, command-wide, mission-impact analysis to identify all cyberspace mission 
requirements and tasks, needed resources, and capability gaps affecting their ability to 
effectively implement C2 of cyberspace operations. 


(U//fewe) USCYBERCOM 
CSE Requirements 

(CjljmCLTO UCAi ntPV] uscybercom 
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” (L)//nBB) The seven Combatant Commands are USPACOM, US. European Command, US. Northern Command, 
U.S. Transportation Command, US. Africa Command, US. Special Operations Command, and USSTRATCOM. 
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(U//!*®W] The Deputy's Management Action Group| 

because 

implementing and Fielding Cyber Mission Forcesy||||j||||||||m||m|H|^^|^^|, 
Although the reasons for the Deputy's Management Action Group decisions^^y 

the Manpower 

USCYBERCOM; the Director, Command, Control, Communications, and Computers and 
Information Programs Division, Cost Assessment and Program Evaluation: and 
officials from the Joint Staff and Office of the Deputy Assistant Secretary of Defense for 
Cyber Policy stated that|m||m|||H|||||||||||m^^^^| USCYBERCOM's request did 

not clearly explain the differences between JCC and 
CSE functionality. Additionally, they stated that the 
request did not distinguish the forward-deployed 
positions from a growth in headquarters personnel. 
A May 2011 Government Accountability Ofiice 
report'^ concluded that the Military Services may 
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USCYBERCOM's request did 
not clearly explain the 
differences between JCC and 
CSE functionality. 


” (U) Government Accounlabillty office Report 11-421, ‘More Detailed Guidance Needed to Ensure Military Services 
Develop Appropriate Cyberspace Capabilities," May 20,2011. 
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Finding 


(U//PWf9) have difficulty in meeting their personnel requirements in organizing, 
training, equipping, and providing cyber forces because of the limited DoD cyber 
workforce. We recognize the need to prioritize competing requirements in a 
resource-constrained environment. However, the Joint Staff 



’‘(U//WMt Asof July 2014, USCYBERCOM provided liaison officers to allCombaianl Commands with the exception of 
U.S. Africa Command. 
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(U//F0H0) Limited Reliance on Cyberspace Operations 


Since the Secretary of Defense issued direction to standardize 
C2 of cyberspace operations in May 2012 by requiring combatant commanders to 
establish JCCs and for USCYBERCOM to provide CSEs, USPACOM and USCENTCOM 


began the process of institutionalizing cyberspace to meet Joint Staff guidance. MBUM 
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(U) Recommendations, Management Comments, and 
Our Response 


(U) Revised Recommendations 


(U//WtWi As a result of management comments, we revised Recommendation 2 to 
ensure the detailed, command-wide, mission-impact analysis addressed not only 
cyberspace tasks included in the Transitional Cyberspace Operations C2 Concept of 
Operations, but also accounted for other cyberspace requirements and tasks affecting 
each Combatant Command. We also revised Recommendation 3 to clarify that 
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(U) Recommendation X 

(U) We recommend that the Director, Joint Staff develop a communications 
strategy for disseminating incremental decisions and timely guidance affecting 
cyberspace command and control to facilitate cross Combatant Command 
information sharing and to allow the combatant commanders to effectively plan 
and prioritize cyberspace operations and integrate Cyber Mission Forces into 
operations until the end-state for command and control of cyberspace operations 
is defined and achieved for all Combatant Commands. 

(U) Joint Staff Comments 

(U//P9U0] The Vice Director, joint Staff, responding for the Director, Joint Staff, agreed 
with the report. 


(U) Our Response 

(U) Although the Vice Director agreed with the report, he did not state agreement or 
disagreement with or address the specifics of the recommendation on a draft of this 
report. Therefore, we request that the Director, Joint Staff provide comments on the 
final report by January 8,2015. 


(U) Recommendation 2 


(U) We recommend that the Commanders, U.S. Northern Command, 

U.S. Transportation Command, U.S. Pacific Command, U.S. Southern Command, 

U.S. Central Command, U.S. Africa Command, U.S. European Command, 

U.S. Strategic Command, and U.S. Special Operations Command conduct a detailed, 
command-wide, mission-impact analysis to identify all cyberspace mission 
requirements and tasks, needed resources, and capability gapsf 
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(U) USCENTCOM Comments 


(U) The Chief, Manpower Division, ]1, responding for the Commander, USCENTCOM, 
agreed, stating that USCENTCOM internally completed a mission-impact analysisH 
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(U) Our Response 

Although the Chief, Manpower Division agreed, the comments partially 
addressed the specifics of the recommendation. The workload analysis did not meet the 
intent of performing a detailed, command-wide, mission-impact anal 3 rsis. We 
acknowledge that initial external manpower studies were completed during 2012 and 



requested an updated workload analysis during the audit to determine USCENTCOM's 
ability to complete cyberspace tasks directed by the joint Staff and to determine 
whether USCENTCOM JCC personnel performed other tasks to complete additional 
cyberspace requirements. For example, the 2013 Execute Order includes additional 
cyberspace requirements related to achieving operational control over specific Cyber 
Mission Forces. However, USCENTCOM did not provide further documentation showing 



Commander, USCENTCOM reconsider his position and provide additional comments on 
the final report by january 8,2015. 


(U) Management Comments Required 

[U) The Commanders, USPACOM; U.S. European Command; U.S. Southern Command; 
U.S. Special Operations Command; U.S. Transportation Command; USSTRATCOM; 

U.S. Northern Command; and U.S. Africa Command did not respond to the 
recommendation on the report. We request that the commanders provide comments 
on the final report by january 8,2015. 
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Finriing 


(U) Recommendation 3 


(U) We recommend that the Commanders, U.S. Strategic Command and U.S. Cyber 



(U) USCYBERCOM Comments 


(0//nGL TO UCA;nfOV) The Deputy Commander, USCYBERCOM, responding for the 




(U) Our Response 


Comments from the Deputy Commander partially addressed 
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Therefore, we request that the Commander, USCYBERCOM reconsider his 
position, and provide additional comments on the hnal report by January 8, 2015. 


(U) Unsolicited Management Comments 

(U) Cost Assessment and Program Evaluation Comments 

(U) Althoughnot required to comment, the Director, Cost Assessment and Program 
Evaluation, stated that DoD was reviewing cyber resource issues for FY 2016 through 
FY 2020 as part of its annual Program and Budget Review. The Director also stated that 
the DoD DIG findings about JCC and CSE resourcing needs would be included as part of 
that review. 

(U) Our Response 

(U) We commend DoD for reviewing JCC and CSE manpower needs as part of the future 
budget process in light of competing requirements in a resource-constrained 
environment. The results of the review could support DoD's ability to resolve our 
concerns and enable the Combatant Commands, the Service Components, and 
USCYBERCOM to effectively meet future cyberspace requirements. 

(U) Joint Staff Comments 

(UZ/Pett®') Although not required to comment, the Vice Director, joint Staff, responding 
for the Director, Joint Staff, agreed with the report but recommended revisions to align 



(U) Our Response 

(U//P®®®) We recognize the 2013 Execute Order requires USSTRATCOM to provide 
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(U//fWW) Combatant Command. We understand the constraints on USCYBERCOM 
and 


Therefore, it is essential for USCYBERCOM and 
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(UJ Appendix A 

(U) Scope and Methodology 

(U) We conducted this performance audit from December 2013 through September 
2014 in accordance with generally accepted government auditing standards. Those 
standards require that we plan and perform the audit to obtain sufficient, appropriate 
evidence to provide a reasonable basis for our findings and conclusions based on our 
audit objectives. We believe that the evidence obtained provides a reasonable basis for 
our findings and conclusions based on our audit objectives. 

(U) We visited Headquarters. USPACOM, Camp H.M. Smith, Hawaii, and Headquarters, 
USCENTCOM, MacDill Air Force Base, Florida. We interviewed officials from the JCCs 
and other joint directorates at USPACOM and at USCENTCOM to determine how 
the commands: 

• (U) established and resourced the JCCs; 

• (U) identified and completed joint Staff-directed tasks and other command 
cyberspace priorities; 

■ (U//4i^^) integrated cyberspace capabilities into operational and contingency 

plans; and 

(U//WOT5 In addition, we interviewed the CSEs at both commands to determine how 
they completed Joint Staff-directed tasks and supported the JCCs in planning and 
integrating cyberspace into operations. At USPACOM, we also met with the Director, J6 
and the Director, ]2 to discuss their plans for building and sustaining cyberspace 
capabilities and supporting the Commander, USPACOM's cyberspace missions and 
responsibilities in the theater. 

[U//i rOUO ) We 

memorandums of agreement with USCYBERCOM for 
CSE support; external manpower assessments related to the organizational missions of 
each command: integrated priority lists from each command identifying its cyberspace 
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(u// p e ue) priorities the USPACOM initial operating capability 

message and the USCENTCOM JCC charter; and internal assessments about their 
abilities to complete the cyberspace tasks directed by the Joint Staff. 

(UJ We visited Headquarters, Fleet Cyber Command, Fort Meade, Maryland, and 
interviewed ofhcials to determine the command's responsibilities for supporting 
USPACOM cyberspace operations at its joint Force Headquarters-Cyber. We also 
visited Headquarters, USCYBERCOM, Fort Meade, Maryland, and interviewed officials 
responsible for planning and directing cyberspace operations and fielding the Cyber 
Mission Forces. We also met with the Chief of Staff and the Director, |8 (Capability and 
Resource Integration Directorate) to discuss their visions on how the Cyber Mission 
Forces would be used in DoD, USCYBERCOM's support of combatant commanders 
cyberspace operations, and USCYBERCOM's efforts to fill CSEs at the 
Combatant Commands. 


(U//P@W) We obtained and reviewed USCYBERCOM manpower-issue papers and its 



; Deputy Secretary of Defense memorandums, "Resource 


Management Decisions for the FY 2014 Budget Request," April 10,2013, and "Resource 
Management Decisions for the FY 201S Budget Request,” March 6,2014, to determine 
USCYBERCOM, USPACOM, and USCENTCOM authorized and funded manpower for 


implementing the Transitional Cyberspace Operations C2 Concept of Operations; 



(U//4iM^ We Interviewed officials from the Joint Staff to determine their 
responsibilities in coordinating and issuing cyberspace requirements, 

We obtained 

reviewed the Transitional Cyberspace Operations C2 Concept of Operations to identify 
USCYBERCOM and combatant commanders' responsibilities for planning, integrating, 
synchronizing, and deconflicting cyberspace operations; a 2012 Air Force Personnel 
Center Manpower Directorate studyBBB^^H^^^^^^^^^^H 


combatant commander's submissions 


the June 21, 2013, Execute Order to determine specific requirements for building a C2 of 
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cyberspace operations construct. We also visited the Joint Staff J? in 
Suffolk, Virginia, and interviewed officials from the Joint and Coalition Operational 
Analysis team to determine their scope, methodology, and results from the year-long 
study from 2012 through 2013 ofDoD's progress in implementing the Transitional 
Cyberspace Operations C2 Concept of Operations. 

(U) We also interviewed officials from the Offices of the ChieflnfoiTnation Officer and 
the Deputy Assistant Secretary of Defense for Cyber Policy and the Director, Command. 
Control, Communications, and Computers and Information Programs Division, Cost 
Assessment and Program Evaluation to determine their responsibilities in issuing 
policy and guidance affecting cyberspace operations and cyber workforce development 
and training, and reviewing combatant commander issue papers related to JMVP 
requests. Furthermore, we interviewed officials from Headquarters, Defense 
Information Systems Agency to determine their responsibilities in supporting 
USCYBERCOM and combatant commanders' abilities to conduct defensive and DoDIN 
operations. We also interviewed officials from the Defense Information Systems 
Agency-Pacific to determine how the agency supported USPACOM's defensive and 
DoDIN operations in the theater. 

(U} We also obtained and reviewed security classification guides from USPACOM, 
USCENTCOM, USCYBERCOM, and the Defense Information Systems Agency, to 
appropriately classify information and portion mark the report. 

(U) Use of Computer-Processed Data 

(UJ We did not use computer-processed data to perform this audit 

(U) Prior Coverage 

(UJ During the last 5 years, the Government Accountability Office (GAO) issued five 
reports discussing issues affecting Combatant Command's abilities to resource and 
conduct cyberspace operations. Unrestricted GAO reports can be accessed over the 
Internet at http://www.gao.gov . 
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(U) GAO 

(U) Report No. 13-293, “DoD Needs to Periodically Review and improve Visibility of 
Combatant Commands’ Resources," May 15,2013 

(U) Report No. 12-8, "Initiatives Need Better Planning and Coordination," 

November 29, 2011 

(U) Report No. 11-75, "DoD Faces Challenges in its Cyber Activities," July 25,2011 

(U) Report No. 11-421, "More Detailed Guidance Needed to Ensure Military Services 
Develop Appropriate Cyberspace Capabilities,” May 20,2011 

ffr) Report No. 10-479C, "DoD Faces Challenges in its Cyber Efforts," May 20,2010 
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(U) Appendix C 

(U) Cyberspace Tasks Directed by Joint Staff 


(U) Table C below lists the 65 (41JCC and 24 geographic Combatant Command) 
cyberspace tasks directed by the Joint Staff and prescribed in the March 15, 2012, 



^ Table C. Cyberspace Tasks Directed by Joint Staff and Status of Completion 
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I 

Joint Staff Cyberspace Tasks 

I 

Status of Completion 

USPACOM USCENTCOM 

I (as of June 2014] (as of February 2013) 


JCC Tasks 
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Status of Completion 

Joint Staff Cyberspace Tasks 1 USPACOM USCENTCOM 

I (as of June 2014) (as of February 2013) 

k I srcOM ib)(l) I 4 |V).CYB?m'OM (bl<l> I^al OSD!0s ibHIM-lt'a) PACOXI fbUll'l 4(ai I 44e> I 



38 i DODIG-201S-048 













Appendixes 





WT 


Joint Staff Cyberspace Tasks 


Status of Completion 
- USPACOM USCENTCOM ' 

(as of June 2014) (as of February 2013) 
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Status of Completion 

Joint Staff Cyberspace Tasks ^ ■ USPACOM USCENTCOM . 

- ^ j (as of June 2014) (as of February 2013) 
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(U) Management Comments _ 

(U) U.S. Central Command 

Final Report 
Reference 
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(U) Source of Classified Information 


Source 1: (U) Department of Defense Strategy for Operating in Cyberspace: 

S//REL TO USA, FVEY 


Declassified Date: May 26, 2036 
Generated Date: May 2011 

Source 2: Joint Publication 3-12, "Cyberspace Operations” 

Declassified Date: September 25, 2034 
Generated Date: February 5, 2013 

Source 3: U.S. Cyber Command Cyber Force 

Concept of Operations, Version 3.4 

Declassified Date: November 20, 2038 

Generated Date: March 31, 2014 

Source 4: (fl//nEL TO UOA, rVEHr) 


l)Ml IS (l>j U 1 I K.iJ 


Declassified Date: June 22, 2038 
Generated Date: June 21,2013 

Source 5: (U) Cyber Mission Force; Concept of Operations: S//REL TO USA, FVEY 

Declassified Date: December 11, 2037 
Generated Date: January 16,2014 

Source 6: FY 2014 - 2016 Cyber Mission Force Fielding 

Timeline 

Declassified Date; May 1, 2039 
Generated Date; Undated 

Source 7: fSJ Cyber Pacific Task Crosswalk - All 259 Tasks 

Declassified Date; June 28, 2039 
Generated Date; June 30, 2014 
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Source ofClassifiecI Information 


Source 8: JCC Joint Manpower Validation Board 

Declassified Date; August 14, 2038 
Generated Date: August 14,2013 

Source 9: (UJ Transitional Cyberspace Operations C2 Concept of Operations Study 

Report: S//NF 

Declassified Date: July 15, 2038 


Generated Date: July 15, 2013 


Source 10: Email from 

Requests for Manpower for PBR16 

Declassified Date: Undated 

Generated Date; June 3, 2014 

Source 11: (0//nEL TO UOA, H 

Declassified Date: June 22, 2038 

Generated Date: Undated 

Source 12: fSTWBCTWWRW 


DoDOfti ib) (<0 


Concerning U.S. Northern Command's 


'USPACOM CSE Binder 


lOSD JS I Mil) I )(g) I 


Declassified Date; June 12, 2037 
Generated Date: June 12,2012 


Source 13: (jS 


Declassified Date: June 18, 2037 
Generated Date: June 18, 2012 


Source 14: Air Force Cyber Command Reclama on 

USCYBERCOM Task Order 12-1387 for USPACOM CSE Personnel Sourcing 

Declassified Date: December 12, 2037 

Generated Date: December 12, 2012 
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Source of Classified Infoniiation 


Source 15: Army Cyber Command Request for Relief of 

Tasking for USPACOM CSE Personnel 

Declassified Date: May 15,2038 

Generated Date: May 15,2013 

Source 16: Fleet Cyber Command USPACOM CSE Personnel 

Support Reclama 

Declassified Date: October 1, 2038 

Generated Date: October 1,2013 


Source 17: Deputy Under Secretary of Defense for Joint and Coalition 

Warfighter Support Action Memo, FY 2014-2018 Joint Manpower Validation for Military 
Intelligence Program Requirements 

Declassified Date; July 20, 2037 


Generated Date: July 20, 2012 
Source 18: (U) Email from 


DuUOJLi UOi'O 
C'VbERCOM (bn 3) lo 
USCij I3iib 


Containing USCYBERCOM Manpower 


Documentation: S//NF 

Declassified Date: February 3, 2039 
Generated Date: February 3,2014 

Source 19: (U) USCYBERCOM Manpower Brief to the DoD IG Audit Team; 

S//REL TO USA, FVEY 


Declassified Date; May 7,2038 
Generated Date; January 15, 2014 


Source 20: (a//RDL TO USA, PVG'l') USCYBERCOM Task Order 13-0747, 

Establishment and Presentation of Cyber Mission Force Teams in FY 2014 

Declassified Date; October 11,2038 


Generated Date: October 11, 2013 

Source 21: CSE Manpower In Support of USPACOM Cyber 

Pacific 

Declassified Date: Undated 
Generated Date: January 18, 2014 
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Source of Classified Iiiforniation 


Source 22: (U) USCYBERCOM Briefing from Chief, Plans Division; S//NF 

Declassified Date: May 10, 2038 
Generated Date: Undated 

Source 23: ^Email from||j|jjH^y| Regarding USPACOM Plans 

Declassified Date; June 25, 2024 
Generated Date; June 25, 2014 

Source 24: USCENTCOM Responses to OIG Follow up 

Declassified Date: March 3,2024 
Generated Date: June 9, 2014 

Source 25: [UJ Transitional Cyberspace Operations C2 Concept of Operations Study 

Final Brief: S//NF 

Declassified Date: July 15, 2038 

Generated Date: July 15,2013 

Source 26: ^ 2014 U.S. Africa Command JMVP Request 

Declassified Date: Undated 
Generated Date: May 27, 2014 

Source 27: (U) U.S, Special Operations Command JMVP Submission for FY 2016 

President’s Budget Request: S 

Declassified Date: February 11,2038 

Generated Date: May 29, 2014 

Source 28; USPACOM JCC Manpower Issue Paper Submitted to Office of the 

Secretary of Defense Cost Assessment and Program Evaluation 

Declassified Date; November 19, 2038 

Generated Date; November 20, 2013 

Source 


Declassified Date: September 27,2023 
Generated Date: Undated 
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•Source ol'Classified Inl'ormalion 


Source 30: USCENTCOM Capability Gap Analysis 

Declassified Date; March 3,2024 
Generated Date: Undated 

Source 31: ^ Cyber Pacific Task Crosswalk Assessments with Mission 

Capability and Task Attribution- Transitional Cyberspace Operations C2 Concept of 
Operations Only 

Declassified Date; April 30,2039 

Generated Date: June 13,2014 

Source 32: Response to DoD IG Inquiry; Cyber Pacific Task Analysis 

Letter: S 

Declassified Date; June 6,2024 
Generated Date: June 6,2014 

Source 33: Extract from the Commander, USCENTCOM 

Integrated Priority List, Priority 7, USCENTCOM Full Spectrum Cyberspace Operations 

Declassified Date; March 3,2024 

Generated Date: Undated 

Source 34: [U) USCENTCOM Science and Technology Integrated Priority List 

Synopsis for Supporting Requirements for 11 of the FY 16-20 Integrated Priority Lists: 
S//NF 


Declassified Date; April 10,2024 
Generated Date: Undated 

Source 35: (U) USCENTCOM 2014 Science and Technology Support Requirements; 

S//NF 


Declassified Date: April 10, 2014 
Generated Date: April 10, 2014 
Source 36: [CjOrnGL TO UCAj rVGY) 


OSD.'JS (b)(1). I J(a) I 4(e). I 4(g) 


Declassified Date: October 4, 2038 
Generated Date; October 4,2013 
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Source of Classified Information 


Sources?: fS^ yWBL ' TO USA, rVD'l') USCENTCOM )CC Charter 

Declassified Date: February 22, 2038 
Generated Date: March 14, 2013 

Source 38: (U) Operations Deputies Tank Review of USCYBERCOM Manpower 

Request: S 

Declassified Date; July 1, 2037 
Generated Date; July 25, 2012 

Source 39: [U) Resource Management Decisions for the FY 2014 Budget Request; 

S//NF 

Declassified Date: April 10, 2038 
Generated Date; April 10,2013 

Source 40: (U) Resource Management Decisions for the FY 2015 Budget Request; 

S//NF 

Declassified Date: March 6,2039 
Generated Date; March 6,2014 

Source 41: (C/jinEL TO UCA, TVOV) USCENTCOM CSE Personnel Support Reclama 

from Commander, Fleet Cyber Command 

Declassified Date: October 1, 2038 

Generated Date: October 1,2013 

Source 42: ^ USCYBERCOM Instruction 5200.07, Cyber Mission Forces Security 

Classification Guide 

Declassified Date; September 1,2023 

Generated Date: November 26, 2013 

Source 43: (UJ Government Accountability Office Report GAO-10-479C, DoD Faces 
Challenges in Its Cyber Efforts: S 

Declassified Date; May 6,2020 

Generated Date; May 2010 
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XU) Acronyms and Abbreviations 


C2 

Command and Control 

CSE 

Cyber Support Element 

OoDIN 

DoD Information Network 

JCC 

Joint Cyber Center 

iMVP 

Joint Manpower Validation Process 

USCENTCOM 

U.S. Central Command 

USCYBERCOM 

U.S. Cyber Command 

USPACOM 

U-S- Pacific Command 

USSTRATCOM 

U.S. Strategic Command 
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Whistleblower Protection 

U.S. Department of Defense 

The Whistleblower Protection Enhancement Act of 2012 requires 
the Inspector General to designate a Whistleblower Protection 
Ombudsman to educate agency employees about pivbibitions 
on retaliation, and rights and remedies against retaliation for 
protected disclosures. The designated ombudsman is the DoD Hotline 
Director. Por more information on your rights and remedies against 
retaliation, visit www.dodig.mil/programs/whistleblower. 


For more information about DoD IG 
reports or activities, please contact us: 

Cungressional liaiscm 
congressional@)dodig.mjl; 703.604.8324 

Media Contact 

public.affairs^dodig.mil; 703.604.8324 
Monthly Update 

dodigconnect-request@ljstserve.com 

Reports Mailing List 
dodig_report@)li$tserve.com 

Twitter 

twitter.com/DoD_IG 


DoD Hotline 
dodig.mil/hotline 
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